SparkCat Malware Uses OCR to Extract Crypto Wallet Recovery Phrases from Images

A new malware campaign dubbed SparkCat has leveraged a suit of bogus apps on both Apple's and Google's respective app stores to steal victims' mnemonic phrases associated with cryptocurrency wallets. The attacks leverage an optical character recognition OCR model to exfiltrate select images...

CVE-2024-21505

Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge. An attacker can manipulate an object's prototype, potentially leading to the alteration of the behavior of all objects inheriting...

MAL-2025-1236 Malicious code in web3-trade (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8535d63f8ed51333fab465ed5f1b0997affed89872dea1d6d384a25c17112caa Any computer that has this package installed or running should be considered...

Malicious code in web3-trade (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8535d63f8ed51333fab465ed5f1b0997affed89872dea1d6d384a25c17112caa Any computer that has this package installed or running should be considered...

Malicious code in web3-eth (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-1006 Malicious code in web3-eth (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in eth-web3 (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-921 Malicious code in eth-web3 (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-1195 Malicious code in web3-onboard-sandbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 539dc0279cc6a739adf371f7670ad0946dfd3a95b07e9f55f88a2047dc7568eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in web3-onboard-sandbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 539dc0279cc6a739adf371f7670ad0946dfd3a95b07e9f55f88a2047dc7568eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in web3-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f572ff12e76b413beb79e843e9a403a5708b245f9f7ba85d18119e1074bf4fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-582 Malicious code in web3-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f572ff12e76b413beb79e843e9a403a5708b245f9f7ba85d18119e1074bf4fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Lazarus Group Targets Web3 Developers with Fake LinkedIn Profiles in Operation 99

The North Korea-linked Lazarus Group has been attributed to a new cyber attack campaign dubbed Operation 99 that targeted software developers looking for freelance Web3 and cryptocurrency work to deliver malware. "The campaign begins with fake recruiters, posing on platforms like LinkedIn, luring...

AI, Web3 and Decentralization: Tech Trends Shaping 2025’s Altcoin Season

Prepare for the 2025 altcoin season: experts predict rising interest in altcoins like WorldCoin, driven by Web3, blockchain,…...

MAL-2025-38 Malicious code in alchemy-web3-webpack-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0baf7db6925882a96eddaa00b4877f9147183d9b00a85fd69b02e5fe625f7ff7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

RPC Management Has Come A Long Way In Two Short Years.  Here’s Why.

Explore RPC Management: Learn how modern decentralized RPC providers solve scalability & connectivity issues in Web3, ensuring secure,…...

Malicious code in web3-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 965af70ebf07de371170bda6a257b464ee058430c0f1d6112323bacabbe19d5c The OpenSSF Package Analysis project identified 'web3-docs' @ 9.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2024-11876 Malicious code in web3-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 965af70ebf07de371170bda6a257b464ee058430c0f1d6112323bacabbe19d5c The OpenSSF Package Analysis project identified 'web3-docs' @ 9.9.9 npm as malicious. It is considered malicious because: - The package...

CVE-2024-12265 Web3 Cryptocurrency Payments by DePay for WooCommerce <= 2.12.17 - Missing Authorization to Information Exposure

The Web3 Crypto Payments by DePay for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/depay/wc/debug REST API endpoint in all versions up to, and including, 2.12.17. This makes it possible for unauthenticated attacker...

CVE-2024-12265 Web3 Cryptocurrency Payments by DePay for WooCommerce <= 2.12.17 - Missing Authorization to Information Exposure

The Web3 Crypto Payments by DePay for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/depay/wc/debug REST API endpoint in all versions up to, and including, 2.12.17. This makes it possible for unauthenticated attacker...